Security

Access follows how a school is organized. Teachers see the classes on their own teams, the children in those classes, and any children they added themselves. Staff at a school see each other’s names, email addresses and photos. School administrators see their school, and district administrators see their district. One district never sees another’s schools, and one school never sees another’s children.

The exception is Mastery Board, LLC’s own administrators. They can see and change every district’s records, so they can set up districts and schools, manage accounts and help when something goes wrong. The people who run the service can also reach the database through its hosting account to maintain it.

These rules live in the database, as row-level security on every table. The app has no master key that could read around them: each request runs as the person who is signed in, and the database returns only what that person may see. Steps that need to reach further, such as moving a child to another school or accepting an invitation, are database functions, about forty of them. Each one checks who is asking, and what they are allowed to do, before it does anything.

• Moving a child to another school is limited to district administrators and Mastery Board, LLC’s own administrators.
• Taking someone off a team ends their access to that team’s classes and the marks recorded in them at once. They can still see the names of children they entered themselves while they remain at the school.
• Taking someone off a school ends their access to everything at that school at once, including its teams and the children they entered.
• A teacher can add a colleague from the same school to their team, which opens that team’s classes to the colleague.
• Only Mastery Board, LLC’s administrators can add or remove districts, or remove schools. A district administrator can also add a school to their own district.

• Accounts can only be created from an invitation. The database refuses to create an account for an email address without an invitation that is waiting, including through the sign-in service directly.
• An invitation is sent to one email address and can be used only by the account with that address. It names the school, or the district for a district administrator, and for a teacher can also name a team. It expires after 14 days and can be withdrawn.
• Accounts sign in with an email address and a password of at least 8 characters. Two-step sign-in and school single sign-on are not offered yet.
• Passwords are never stored. The sign-in provider keeps only a secure one-way hash of each one.
• Password reset links are sent by email, work once, and expire.
• The sign-in and password reset pages don’t reveal whether an email address has an account.
• Signing out ends the session in that browser.
• When a session ends, saving says so rather than failing quietly, and marks, notes and template changes waiting to save stay on screen.

The database records every change people make to marks, absences and notes, children and the classes they are in, classes and the templates on them, templates, and who has access to districts, schools and teams: who made it, when, and what it changed from and to.

• School administrators can read their school’s change log, and district administrators their district’s. Teachers can’t read it.
• Nobody using the app can write, change or delete an entry.
• Invitation links are never recorded.

• In transit: every connection to the app and its database uses HTTPS (TLS).
• At rest: the database and uploaded files are encrypted by Supabase.
• Files: documents and profile photos are kept in private storage. A document is checked against who may see it, then opened through a link the app makes to expire after 60 seconds. A profile photo is checked the same way and sent straight to the browser of the person viewing it. Uploads are limited by type and size: documents to PDF, Word, Excel and images up to 50 MB, photos to 2 MB.
• In the browser: pages tell browsers to use HTTPS only and not to guess file types. When a link leads to another site, the browser tells it only that the visitor came from Mastery Board, never which page. Only Mastery Board itself and Schoology may show its pages inside theirs.
• No tracking: the app loads no advertising, analytics or other third-party scripts.

• The database’s rules are tested automatically. A suite of more than 1,300 checks builds a fresh database from the app’s migrations. It then acts as teachers, administrators and outsiders across two districts, and checks, case by case, what each of them can and cannot see and change, and that records stay consistent.
• Every change to the code is checked automatically when it is pushed: type checks, linting, the test suites and the database suite.
• A code review. In September 2026 we reviewed all of the app’s code and its database, covering access rules, data handling and error handling, and fixed what the review found.

Vercel and Supabase run their own security programs and are independently audited. What each provider handles is on the Privacy page.

• Invite only the staff who need Mastery Board, with the role they need.
• Take people off teams when they change jobs, and tell us when someone leaves a school so we can remove them from it.
• Keep notes about a child to what they are learning.
• Use a password that isn’t used anywhere else.

If you think you have found a security problem, or that someone has seen information they shouldn’t have, write to info@masteryboard.com. We will reply within two business days, look into it straight away, and keep you told what we find. Please don’t test against other people’s accounts or data.

If information is ever accessed without permission, we will tell the affected schools and districts promptly, explain what happened and what we are doing about it, and meet the notification requirements of the law.